Logstash 配置nginx日志

介绍

配置

vim nginx_access.conf

input {
      file {
        path => [ "/var/log/nginx/access.log" ]
        start_position => "beginning"
        ignore_older => 0
      }
}

filter {
    grok {
          match => { "message" => "%{COMBINEDAPACHELOG} %{QS:x_forwarded_for}"}
          }
    date {
            match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
        }
    geoip {
            source => "clientip"
          }
}

output {
    elasticsearch {
        hosts => ["IP"]
        index => "nginx-access"
    }
    stdout {codec => rubydebug}
}